CVE-2026-31464 Linux内核ibmvfc驱动越界访问漏洞

/* * Conceptual PoC for Vulnerable Logic in ibmvfc * This snippet demonstrates the lack of bounds check. */ void ibmvfc_discover_targets_done(struct ibmvfc_event *event) { struct ibmvfc_host *vhost = event->vhost; struct ibmvfc_discover_targets *srp = &vhost->disc_buf; // Vulnerability: num_written from VIO server is not validated against max_targets u32 num_written = be32_to_cpu(srp->mad.common.status); // Direct assignment without clamping vhost->num_targets = num_written; // This leads to OOB access in ibmvfc_alloc_targets if num_written > max_targets if (num_written > vhost->max_targets) { // Missing check in vulnerable version printk(KERN_ERR "Potential OOB access detected: %d > %d\n", num_written, vhost->max_targets); } } /* * Fix Implementation (Clamping) */ void ibmvfc_discover_targets_done_fixed(struct ibmvfc_event *event) { struct ibmvfc_host *vhost = event->vhost; struct ibmvfc_discover_targets *srp = &vhost->disc_buf; u32 num_written = be32_to_cpu(srp->mad.common.status); // Fix: Clamp num_written to max_targets if (num_written > vhost->max_targets) { dev_warn(vhost->dev, "Discover targets response exceeded max_targets, clamping\n"); num_written = vhost->max_targets; } vhost->num_targets = num_written; }